Regulating Medicine on the Internet

Although the Internet is an important tool in the health-care field, legal issues related to medical record privacy and confidentiality, health-care quality assurance, and medical e-commerce need to be resolved through regulation to protect health-care providers and consumers. Here is an overview of some important areas that require tighter controls.

In May, hackers broke into a medical records database in Virginia and demanded extortion payments after causing considerable damage.1 This was similar to a previous cyber-attack in California that started in October 2008.2 Not only are medical records and other health-care information Web sites vulnerable, but so are sites engaged in e-commerce in the health-care field. A crude Internet search using a term like “drugs without prescription” yields thousands of results. Both the Food and Drug Administration (FDA) and the Drug Enforcement Administration (DEA) have issued warnings regarding Internet drug sales, and such sales are a major source of spam email. According to the DEA, “Prescription drugs … are widely accessible and often illegally purchased through the Internet. … [R]ogue Internet sites are not there to benefit the public, but to generate millions in illegal sales. … More often than not, a ‘rogue’ site will also provide for invalid prescriptions based on the completion of a cursory questionnaire. This process … elicit[s] what drug the customer wants and what the method of payment will be, rather than diagnosing a health problem and establishing a sound course of medical treatment.”3 While there is a myriad of health-care information available on the Internet, much of it is highly technical and difficult for even trained professionals to understand. Without necessarily intending to, well-meaning people who provide health-care information on the Internet may mislead or otherwise confuse desperate patients and families.4

Although the potential benefits of the Internet will likely lead to increased efficiency and quality of health care and significant cost savings in a $2.51 trillion industry,5 there are many legal pitfalls that must be addressed. In the midst of the heated health-care reform debate, calls for electronic medical record-keeping and widespread use of the Internet for obtaining medical information and health-care related advice and engaging in health e-commerce, these potential legal issues must be carefully considered to make full use of the Internet’s potential in the health-care field.6 This article, although not exhaustive, examines some of the more important areas that require consideration by lawyers, judges, policymakers, and others involved with health-care issues and health-care reform. While Internet use can be an important part of lowering health-care expenditures, the possible problems that may arise with such increased use of Internet resources in the health-care arena have only just begun to be recognized and addressed.

At one end of the spectrum of health-care sites on the Internet are those that simply provide information, ranging from general to specific, on diseases.7 Medical and scientific organizations, such as the American Heart Association and the American Medical Association (AMA), and Medscape, WebMD, and other information providers maintain Web sites containing medical information and discussions of health-care public policy, ethics, and many other topics.8 Many medical publishers, drug companies, and other commercial entities in the health-care field also provide general information.9 Other sites allow consumers to ask a physician or other health-care professional questions about specific problems that relate to the consumer’s own situation.10

The value of this kind of interaction over the Internet is not in question. However actions by hackers and identity thieves should raise alarms regarding confidentiality and privacy.11 The Health Insurance Portability and Accountability Act of 1996 (HIPAA) continues to apply, but more laws and regulations may be needed in the Internet era to protect privacy and confidentiality.12 Encryption software is available to protect privacy and confidentiality, but such software is needed both to send and to receive confidential information. Many consumers are unaware of the dangers, and standard encryption software must be made available to both users and providers at a reasonable price. This is not currently the case.13

The AMA, Intel, and others have proposed developing digital credentials for physicians to help ensure reliability and accountability of the information and advice provided.14 The AMA also has promulgated guidelines for maintaining privacy and confidentiality in Internet communications, and a consortium of health-care Web sites has produced its own ethical guidelines.15The Department of Health and Human Services (DHHS) also has announced regulations for securing electronic medical data.16 Patients and physicians are increasingly using email to communicate, raising the possibility that hackers will be able to obtain personal information provided to the physician.17 Specific state and federal statutes may apply, and suits for breach of privacy or confidentiality, and in some contexts medical malpractice, provide tort-law protections in health-care Internet communications.18

While direct access to MEDLINE, Medscape, WebMD, and other such sources provides valuable information to the health-care consumer, reading the medical literature can be a daunting task. A study by a group of physicians at the University of Michigan examining Web sites about Ewing’s sarcoma, a form of bone cancer, illustrates the magnitude of the problem.19 More than half of the studied sites contained information that had never undergone scientific review, and a significant proportion contained easily misunderstood, inaccurate, misleading, or confusing information. Impaired judgment and emotional strain may allow easily confused users to be manipulated, even when there is no intent by the information provider to mislead the consumer.20

Philip M. Kober, Valparaiso 2001, also holds a Ph.D. in physiology (Loyola-Chicago 1983) and an M.D. (Rush Medical College, Chicago, 1994). He maintains a law office in Watertown, practicing at the interface of law and medicine. He consults on significant health care-related issues and advocates for patients and families with medicolegal problems. Reach him at net doclawpmk aol aol doclawpmk net.

A license to practice medicine is not generally required to simply provide information unless a patient-physician relationship is created by providing a diagnosis or recommending treatment.21 Indeed, self-help Web sites created by patients and their families can be very useful in coping with diseases. Clearly stated, prominent disclaimers should be used to prevent over-reliance on such Web sites. However, self-help and other Web sites that simply provide information are not a substitute for seeking the advice of one’s own physician, and the legal enforceability of such disclaimers remains unclear.22

There have been many proposals for rating or accrediting Web sites to ensure quality, but these proposals have all met with substantial criticism and resistance to implementation. Minimally, there should be adequate disclosure of authorship and credentials or background to allow consumers to make their own judgments as to quality, and physicians should be willing to answer questions about particular Web sites that their patients may be using.

The provision of specific advice with regard to diagnosis and treatment or prevention may create a patient-physician relationship and thus the potential for malpractice liability. Even if there is no patient-doctor relationship, causes of action for fraud or misrepresentation may still lie, especially in situations in which willful, wanton, or reckless conduct is involved.23 Long-arm jurisdiction and determination of when a patient-physician relationship exists under these circumstances of Internet-based interactions are issues that may need to be resolved in court.24 Modification of state medical-licensure laws has been proposed to clarify the applicability of the laws to situations in which medical advice is proffered over the Internet, but this has created considerable resistance among state governments.25 With increasing remote consultation by specialists and other uses of e-health information, it is time for medical boards, legislatures, and members of the legal profession to debate and discuss the issue of medical licensure laws and other aspects of the application of law to health-information exchange over the Internet.

Drugs, Medical Devices, and Health-care Services on the Internet

At the other end of the spectrum of Internet health-care sites are health e-commerce sites that provide cost savings and convenience by allowing consumers to purchase prescription drugs and medical devices and make arrangements for health-care services, including surgery.26 The convenience to consumers and physicians makes online pharmacies and Internet sellers of medical devices and supplies extremely attractive to patients.27

Health e-commerce, however, is prone to fraud and other problems. Several online pharmacies provide prescription drugs on the basis of questionnaires that are evaluated by unscrupulous physicians, without any physical examination or other direct interaction between physician and patient, and some Internet pharmacies provide drugs, including narcotics and other scheduled drugs, without any prescription whatsoever.28 There is little or no follow-up and only minimal effort is made to ascertain whether there is a clinical indication for the requested drug in many cases, and there may be little or no discussion of risks and benefits of a particular medication.29 Some sites openly advertise the availability of unapproved medications.30 Other sites have provided counterfeit drugs to unsuspecting consumers.31 Sales from Internet pharmacies are fueled by pharmaceutical manufacturers’ direct-to-consumer advertising, which is often poorly understood by consumers.32

Although a few states have sued online pharmacies to stop these impermissible practices, there has not been any concerted effort in this regard.33 New federal legislation, the Ryan Haight Online Pharmacy Consumer Protection Act of 2008, has only recently taken effect and its impact is still unknown.34 This act, moreover, focuses on the problems of narcotics availability but does not even begin to address the wide variety of other drugs that are available on the Internet. Additional enforcement tools certainly are needed.

The AMA and other medical professional societies, including the Federation of State Medical Boards, have issued guidelines for Internet prescribing practice, which have been thoroughly critiqued for potential negative impact.35 The principles, however, are correct: One-stop online pharmacies that diagnose illnesses (often via a short questionnaire) and prescribe and dispense drugs are not providing good medicine – a history and at least a directed physical exam and adequate follow-up are required.36 Medical malpractice and other forms of tort liability should apply here as well.37 Refill prescriptions often can be handled via the Internet, but even then a doctor should occasionally see the patient to monitor progress and to check for complications or adverse side effects. Experimental and unapproved drugs and narcotics and other drugs of abuse should not be freely available. While fraud and abuse in the sale of medical devices and supplies over the Internet has not been widely reported, the potential for trouble is clear.38 The various enforcement and regulatory authorities should pay attention to these sites as well.

Health Care and the Challenges of the Information Age

The Internet is an important and valuable tool in the health-care field, but the legal issues related to privacy and confidentiality, quality assurance, and medical e-commerce need to be resolved. Only then can we as individuals and as a society reap the benefits of greater efficiency and lower health-care costs that this new and expanding resource can provide.

6See, e.g., Gunther Eysenbach & Thomas L. Diepgen, Patients Looking for Information on the Internet and Seeking Teleadvice. Motivation, Expectations, and Misconceptions as Expressed in E-mails Sent to Physicians, 135 Arch. Dermatology 151 (1999) (there is a “plethora of medical information” available to consumers on the Internet).

7MEDLINE is accessible to the public and health-care professionals from a variety of Web sites, including the National Library of Medicine (NLM) site(s): <http://www.ncbi.nlm.nih.gov/PubMed> and <http://igm.nlm.nih.gov>.The NLM has a project to make online health-care information useful to consumers. Medscape adds news and patient-care information, useful to professionals and consumers, and provides access to MEDLINE and other databases, <http://www.medscape.com>.

8For example, the AMA Web site, http://www.ama-assn.org, provides information on health-care policy, patient informational materials, and AMA house of delegates actions. Some materials are available to the public, while other materials are restricted to members.

9For example, Merck & Co. makes its well-known manual series available free to consumers and professionals, <http://www.merck.com/pubs/>. The information is of very high quality but may be difficult for the average consumer to fully comprehend

21See Wis. Stat. § 448.01(9). Under the Wisconsin statutes, the practice of medicine involves interacting with a specific patient to diagnose, treat, or prevent his or her medical problems. Merely providing nonspecific information is not sufficient. Many self-help Web sites, which are perfectly legitimate, provide information about people who share a disease and their experience, and may list additional resources. This should not generally be considered an impermissible practice of medicine.

24E-discovery and long-arm jurisdiction in Internet cases are important issues but are beyond the scope of this article. The crux of the personal jurisdiction arguments in Wisconsin and other states is whether provision of medical information or advice over the Internet constitutes an in-state act or constitutes the provision of medical services even though the act was one out-of-state, or whether the act involves the provision of medical goods through e-commerce to state residents. See Caryl, supra note 18; Barry B. Cepelwicz, Can Foreign States Exercise Jurisdiction Based on Internet Use?, Med. Malpractice L. & Strat., Sept. 1999, at 4.

27See Herman I. Abromowitz, AMA Testimony on the Risks and Benefits of On-Line Pharmacies, Statement of the American Medical Ass’n before the Subcommittee on Oversight and Investigations of the Committee on Commerce of the U.S. House of Representatives, July 30, 1999, http://www.ama-assn.org.

28See supra note 3. Both the DEA and the FDA have extensive materials on illegal drug sales on the Internet and the practices of online pharmacies. A Google search on the phrase “drugs without prescription” or similar wording results in 21,400,000 hits, many of which come from vendors that freely advertise their methods on the Internet in open defiance of the law.

32See Matthew F. Hollon, Direct-to-Consumer Marketing of Prescription Drugs. Creating Consumer Demand, 281 JAMA 382 (1999). As one example, people are taking Viagra and other similar drugs simply because it has an effect on “sex” without any knowledge of its mechanism of action. See Mike McKee, Online Viagra Raising Questions. Internet Sales of the Potency Drug Expand Faster than Regulations, San Francisco Recorder 1 (May 21, 1998).

34Ryan Haight Online Pharmacy Consumer Protection Act of 2008, Pub. L. No. 110-425, 122 Stat. 4820, see 21 U.S.C. § 801 note, amends the Controlled Substances Act to provide further regulatory requirements for pharmacies selling narcotics and other controlled substances over the Internet. Final implementation of this law occurred in April 2009 with final comments due in early June 2009. See 21 CFR pts. 1300, 1301, 1304, 1306, Implementation of the Ryan Haight Online Pharmacy Consumer Protection Act of 2008, 74 F.R. 15596-15625 (April 6, 2009).

35See AMA, Guidance for Physicians Prescribing on the Internet, Policy H-120.949, June 19, 2003, <www.ama-assn.org/> [hereinafter AMA Guidelines]; Model Guidelines for the Appropriate Use of the Internet in Medical Practice, Federation of State Medical Boards of the United States, (2002) <www.fsmb.org> [hereinafter Model Guidelines].

36See AMA Guidelines supra note 35; Model Guidelines supra note 35. Sufficient dialogue between patient and physician must take place to firmly establish a diagnosis and plan of treatment and for adequate followup and monitoring of patient progress. A short questionnaire is insufficient for good medical care.

38The potential for cyberattacks on devices like pacemakers is a real possibility, especially with modern devices that allow physicians to access data and control settings over the phone and the Internet. See Larry Greene-meier, Heart-Stopper: Could Hackers Hit Pacemakers, Other Medical Implants?, Sci. Amer. (March 14, 2008), <http://www.scientificamerican.com/article.cfm?id=heart-stopper-med-device-hack>.